What is the difference between Computer Forensics and Electronic Discovery?

Electronic Discovery of data is an extension of the Federal Rule of Civil Procedure 26(a) (1) which governs the disclosure of “all documents, data compilations and tangible things” subject to discovery in litigation. Electronic Digital Discovery is primarily an organization tool, allowing the user to process, locate, recall, and parse large amounts of data using powerful electronic searching and indexing tools. Considering that more than 90% of all documents and communications are produced digitally, and many of these are never printed to paper media, Electronic Digital Discovery is a very powerful tool.

Electronic Digital Discovery is not an investigative or analytic tool. It is limited for example, to organizing and retrieving only that portion of the information on a computer that everyone can see, access, and copy. If data that supports your legal theory or strategy has been deleted, hidden, or otherwise rendered invisible to the computer’s operating system, you won’t find that information using Electronic Discovery.

Computer forensic analysis, on the other hand, is an inclusive analytic tool that identifies, extracts, preserves, and searches both the visible and the “invisible” information on a computer. Computer forensic analysis finds, compiles, and parses all the evidence, including evidence comprising deleted files, unallocated space, slack space, hidden files, and encrypted files. Once all the evidence has been located, extracted, compiled, and parsed, it can be inserted into common Electronic Discovery tools and integrated into a case. Thus, Computer Forensics is a powerful engine that enhances the Electronic Discovery process because Computer Forensic analysis gives you all the information Electronic Discovery can provide plus a whole lot more.

Close